"The DNSChanger malware modifies DNS settings to use malicious servers that point users to fake sites and other harmful locations," he said. "DNSChanger attempts to modify the settings on home routers as well, meaning other computers and mobile devices may also be affected."

This is not the first time that a cleanup has been attempted, and Menscher said that those responsible for running the malware were arrested last year. Since then, he said, ISPs and the Internet Systems Consortium have also joined the efforts. However, so far they have had little success.

"Many of these campaigns have had limited success because they could not target the affected users, or did not appear in the user's preferred language (only half the affected users speak English as their primary language)," he added.

"At the current disinfection rate hundreds of thousands of devices will still be infected when the court order expires on July 9th and the replacement DNS servers are shut down. At that time, any remaining infected machines may experience slowdowns or completely lose Internet access."

The half a million users are expected to be notified within a week, but Google might not find everyone who is infected.

"While we expect to notify over 500,000 users within a week, we realise we won't reach every affected user. Some ISPs have been taking their own actions, a few of which will prevent our warning from being displayed on affected devices. We also can't guarantee that our recommendations will always clean infected devices completely," added Menscher.

"Some users may need to seek additional help. These conditions aside, if more devices are cleaned and steps are taken to better secure the machines against further abuse, the notification effort will be well worth it."